## Basic information **Project name:** Eclipse Theia **Project id:** {id} ## What are the affected versions? v1.45.0 (Lates) below versions should be vulnerable too ## Details of the issue Heyy there, I reported the same issue via email `security@eclipse-foundation.org` 3 days ago but didn't recieved any response so I decided to ping here.Below you will find the details SonarSource's Security Research team recently released a series of writeups related to VSCode security, where they were able to uncover many one-click arbitrary code execution vulnerabilities. I got pretty excited with those as there was one bug which had affected many IDEs in the past so I gave it a try in Eclipse Theia also and it worked :) This attack is based on the research done by author of these blogs, so if you need more info related to this then would recommend reading them: https://github.com/justinsteven/advisories/blob/main/2022_git_buried_bare_repos_and_fsmonitor_various_abuses.md https://www.sonarsource.com/blog/securing-developer-tools-git-integrations/ Code Editors often have Git Integration where they work with user-supplied Git repositories. A malicious user could create a folder which has malicious `.git/config` file , the victim when opens such a folder the code editor executes some basic `git` commands such as `git status` automatically upon detecting that folder contains a .git directory An example content of .git/config file looks like this : ``` [core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true ``` From the documentation we can get to know about many different properties , one such property interesting in our case is the `fsmonitor` ``` [core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true fsmonitor = "id > /tmp/fsmonitor && echo" ``` If you try executing the `git status` command on a directory which contains the above content in the `.git/config` file. The value provided in the `fsmonitor` variable, will be happily executed eg in this case the output of `id` command is stored in `/tmp/fsmonitor` file There is just one problem, upon using git clone it is not exploitable because cloning a repo does not allow the remote to sufficiently control files within the client's .git/ directory. But Justin Steven found a solution to this in his past research , you can find more details on this under this section _OVE-20210718-0001 - git checks out bare Git repos embedded within regular Git repos_ https://github.com/justinsteven/advisories/blob/main/2022_git_buried_bare_repos_and_fsmonitor_various_abuses.md Basically , bare repos allows you to have another .git directory inside a repo. Bare repos are not under the .git instead they are in the parent folder. I am using same exploit as used by Justin Steven Visual Studio Code POC (Chained with OVE-20210718-0001 via git clone) Here's the repo where I have uploaded the exploit poc: https://github.com/Sudistark/gitconfig-rce This repo has these files which are important for this attack: .vscode/settings.json ```json {"git.ignoredRepositories": ["."]} ``` This configuration parameter is to tell Code OSS to ignore the root directory for Git repository purposes. The directory shirley/ contains an embedded bare repo with a malicious config file, per OVE-20210718-0001 ``` [core] repositoryformatversion = 0 filemode = true bare = false worktree = "worktree" fsmonitor = "calc.exe" ``` ## Steps to reproduce I have already created a repo by following the steps mentioned in Justin's Blog For Windows: https://github.com/Sudistark/gitconfig-rce For Linux: https://github.com/Sudistark/gitconfig-rce-linux The only difference in them is the command placed inside the `fsmonitor` ``` calc.exe // for windows echo \"Pwned as $(id)\">/tmp/win;false // for linux ``` Use the poc according to your OS, in case of Windows (gitconfig-rce) this will popup calc.exe In case of Linux, check the contents of /tmp/win file you should see the output of the id command ```bash cat /tmp/win ``` ## POC Video:  ## Impact: An attacker with such a bug can fully compromise victim's machine , the victim only needs to clone attacker controlled repo and open it in Theia IDE. Code editors are meant to be used to open/view files there should be no harm in just viewing a folder/code ## Do you know any mitigations of the issue? I am not entirely but I think Theia is based on Code OSS? If yes the, VSCode has this thing called Trusted Workspace You can find more details about this Workspace Trust feature here: https://code.visualstudio.com/docs/editor/workspace-trust Whenever a user tries to open a folder for the first time in vscode , a popup like this appears:  On the first line of the popup message you can read it clearly read that _Code Provides features that may automatically execute files in this folder_ If the user selects _No I don't trust the authors_ then the folder is opened in a restricted mode where VSCode takes full responsibility that it's safe to interact with the files there, in case of _Trusted Workspace_ it's insecure and can lead to executing unwanted system commands without user's concern. I reported a similar issue in Cursor also which is based on Code OSS also https://github.com/getcursor/cursor/issues/1093 They had enabled Restricted mode (but it's not enable by default, the needs to enable it specifically from the settings.json file) Would suggest in case of Theia to enable this Trusted Workspace by default, to let the user prompt to choose if the project should be trusted or not. **Note**: This vulnerability is subject to a 90 day disclosure deadline. After 90 days have elapsed or a patch has been made broadly available (whichever is earlier), the vulnerability report will become visible to the public. Let me know if any more info is required. Thankyou Regards Sudhanshu